diff --git a/crates/archivr-server/src/main.rs b/crates/archivr-server/src/main.rs
index 3373fcc..b4ab90d 100644
--- a/crates/archivr-server/src/main.rs
+++ b/crates/archivr-server/src/main.rs
@@ -26,6 +26,21 @@ async fn main() -> Result<()> {
 
     let app = routes::app(registry.clone(), auth_db_path.clone());
 
+    // Spawn session cleanup: runs at startup and every 24h.
+    let cleanup_auth_path = auth_db_path.clone();
+    tokio::spawn(async move {
+        loop {
+            if let Ok(conn) = archivr_core::database::open_auth_db(&cleanup_auth_path) {
+                match archivr_core::database::delete_expired_sessions(&conn) {
+                    Ok(n) if n > 0 => eprintln!("info: cleaned up {n} expired sessions"),
+                    Err(e) => eprintln!("warn: session cleanup failed: {e:#}"),
+                    _ => {}
+                }
+            }
+            tokio::time::sleep(tokio::time::Duration::from_secs(24 * 60 * 60)).await;
+        }
+    });
+
     let bind_str = std::env::var("ARCHIVR_BIND")
         .ok()
         .or_else(|| registry.bind.clone())